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Argument - The Independent Claims are not Obvious in view of Bates and Hericourt 

The arguments put forth by the Examiner in the Answer of May 18, 2009 fail to rebut 
Appellants' arguments. The claimed invention relates to determining the executability of 
computer code in response to a comparison between a time stamp corresponding to an earliest 
moment (or first time) computer code was allowed to execute on a network and a virus alert 
time. As Appellants previously argued, the cited references, whether considered individually or 
in combination, fail to disclose a time stamp "corresponding to an earliest moment the computer 
code was allowed to execute on a computer. . ." or "corresponding to a first time the computer 
code was allowed to execute on a computer..." as variously recited by the independent claims. 

The Examiner's argument hinges on the teachings of Bates, which discloses use of a 
single time stamp indicating the time the file was last checked for a vims. The Examiner uses 
Hericourt to argue that the virus checking can include an execution. However, even under this 
interpretation the combined references fail to disclose or suggest that the time stamp represents 
an earliest moment (or first time) computer code was allowed to execute. Rather, the time stamp 
merely represents an arbitrary execution. 

The Examiner's primary response to this argument is to assert that the time stamp 
represents the earliest or first execution "in relation to the multitude of subsequent, secondary, or 
later executions within that sequence." Answer, Page 20. The Examiner's logic is flawed, 
however, because there is nothing in the Examiner' s interpretation or the references that 
precludes other, earlier, executions from occurring. Thus, it cannot be said that the time stamp 
relied upon by the Examiner represents the earliest moment (or first time) the computer code was 
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allowed to execute. Under the Examiner's logic, every execution would be the "first" one as 
long as there is a subsequent execution. 

In fact, the Examiner has never explained how an execution can be considered the 
"earliest" or "first" if there are previous executions. Instead, the Examiner has mischaracterized 
Appellants' argument. In the Answer the Examiner states: 

. . .the examiner respectfully notes that appellant's admission: 

'. . .there are an arbitrary number of executions that occur. . .after the 
execution represented by the timestamp' (Applicant's Arguments/Remarks 
4/1 1/08, p. 14) 

Answer, page 20. However, Appellants actual argument is that: 

there are an arbitrary number of executions that occur before and after the 
execution represented by the timestamp. 

(emphasis added). Thus, the Examiner has used ellipses omit Appellants' central contention 

from the quote and avoid addressing the main issue: an arbitrary number of executions can occur 

before the execution that the examiner designates "first." 

The Examiner also mischaracterizes the teachings of Appellants specification. At page 

22 of the Answer, the Examiner attempts to equate the claimed invention with the references by 

alleging that Appellants specification shows that the claimed timestamp 

represents a time when an executable file is virus checked by a networked 
computer and the resulting timestamp and hash value from the virus check is 
added to a database or memory table (e.g., see appellant's specification, par. 38, 
50, 51, 60, 61; original claims 21 and 33). 

However, the specification is clear that the timestamp corresponds to the execution time. For 

example, paragraph 38 states "The time stamp of an executable computer code corresponds to an 

earliest moment this particular computer code was allowed to execute by computers 2, 3." The 

specification does state that the time stamp can be placed in the memory table after the file is 
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virus scanned, and that the time stamp can be the time that the hash value was placed in the table. 
However, the specification describes these events as occurring at the time of first execution. 

At page 21, the Examiner responds to Appellants' arguments by making a semantic 
distinction: 

In response, the examiner respectfully notes that the claims do not recite 
"time stamping the earliest or first time code was executed'. 

Instead, the claim language more explicitly states that the timestamp 
corresponds to "an earliest moment the computer code was allowed to execute on 
a computer coupled to the computer network" and "a first time the computer code 
was allowed to execute on a computer coupled to the computer network". 

(emphasis in original). Thus, the Examiner is arguing that Appellants use of "an" and "a" in the 

claims supports the Examiner's interpretation. However, the antecedent basis requirements of 35 

U.S.C. § 112, second paragraph, and the MPEP compel such phrasing. See MPEP 2173.05(e). It 

is unreasonable to use phrasing dictated by the rules to support an interpretation favored by the 

Examiner at the expense of Appellant. 

At the core, the Examiner's argument is that any given time stamped execution is the 
"earliest" or "first" one because any executions that came before it can be excluded. Thus, if 
there were three sequential executions, the Examiner would call execution two "an earliest" 
execution because it occurred before execution three, even though execution one occurred still 
earlier. This interpretation is clearly unreasonable and the rejections of the claims should be 
reversed for at least this reason. 

For the foregoing reasons, as well as for those previously articulated in the Appeal Brief 
of February 13, 2009, Appellants believe that the Examiner's rejection of the claims is clearly 
erroneous, and respectfully request that the Board reverse the rejection. 
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Respectfully submitted, 

CAREY S. NACHENBERG ET AL. 



Dated: June 16, 2009 



By: /Brian Hoffman/ 

Brian M. Hoffman, Reg. No. 39,713 
Attorney for Appellants 
Fenwick & West LLP 
801 California Street 
Mountain View, CA 94041 
Phone: (415) 875-2484 
Fax: (650) 938-5200 
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